CVE-2024-34459

Low

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

In xmllint from libxml2 before versions 2.11.8 and 2.12.7, formatting error messages with --htmlout can cause a buffer over-read in xmlHTMLPrintFileContext.

Risk Assessment

An attacker can cause information disclosure or a crash by sending a specially crafted XML/HTML file to be processed by xmllint.

Recommendation

Update libxml2 to version 2.11.8 or later (for 2.11 branch) or 2.12.7 or later (for 2.12 branch).

Original NVD description (English source)

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.